News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by stephenr on Friday December 13, 2019 @02:46PM (#21784718)
> If you keep using plain sessions you got a SPOF

What single point of failure is inherent with plain server side sessions and a session cookie?

[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by ratherbefuddled on Friday December 13, 2019 @02:47PM (#21784725)
The server.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by stephenr on Friday December 13, 2019 @02:57PM (#21784806)
... ok so assuming you then don’t have a HA environment (Really!?) if the server is down the sessions and the tokens are irrelevant because there’s nothing being served and nothing to use/check them and provide back resources.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by james_s_tayler on Friday December 13, 2019 @11:18PM (#21787780)
You don't have to store them purely in-process. The session data itself can live in Redis. You can scale sessions beyond a single web server.
[ Parent | on HN ]